Safety filters built into major language models are easier to bypass than most labs will admit — and the vulnerability scales with how obscure your language is.
Researchers have released Minionese, a multilingual jailbreak benchmark covering 18 languages sorted into four resource tiers, with four attack types: standard translation, code-switching, transliteration, and translationese. The study finds that each attack method produces its own distinct vulnerability profile. Transliteration success tracks closely with the writing script used, while code-switching — mixing languages mid-sentence — stays effective even in the lowest-resource tier. Most sharply, the researchers identified a consistent safety cliff between what they call Tier 2 and Tier 3 languages across every model tested.
The mechanistic explanation is the uncomfortable part. Low-resource jailbreaks succeed not by breaking the refusal mechanism but by routing harmful content through a geometric subspace the refusal system never learned to cover. The safety layer is present; it just never fires. That distinction matters because it means patching English-language safety is not a fix — it is a false ceiling.
Safety evaluations that run only in English have been the norm across the industry, and this work makes the cost of that shortcut explicit. Labs that benchmark their guardrails in a handful of high-resource languages are, by this analysis, essentially leaving the side door open. The benchmark and code are public, which means red teams now have a structured toolkit that safety teams will need to race to match.